Extracted

• • Target

    emotet_e2_5cc80cc17bbb89808db987af2bbfbe02975c1d67cfb77ac0a9a5af0468a36210_2021-01-13__010534052618._doc

  • Size

    156KB

  • MD5

    bee2316fe772d52b4b09e095aa08a26c

  • SHA1

    cfb13b17a4cd7f425b03d9a8318da7f0482f1253

  • SHA256

    5cc80cc17bbb89808db987af2bbfbe02975c1d67cfb77ac0a9a5af0468a36210

  • SHA512

    a568116eaa8e15ead5188263a3090270f75d48b86a4484eaaa865be84c714e4701d60457d49eb76a6f3fa69f3d24777391ab4a30cddd5d2f19103727bc2264ee

  Score

  10^/10

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • Blocklisted process makes network request

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1